Chain spec files the node deploy can run from (`CHAINSPEC_URL` / the
`chainspec_url` input as a repo path, e.g. `asset/chainspec/mainnet.json`).
Commit only a file verified against the publisher's checksum, and record that
checksum in `CHAINSPEC_SHA256` so the deploy re-verifies it; the started node's
genesis hash is asserted separately against `EXPECTED_GENESIS`.